Voting method

ABSTRACT

A voting method. A ballot paper is received. The received ballot paper includes a recorded vote. The recorded vote includes candidate/party information for an election held on a voting day in a jurisdiction. The ballot paper includes a burnable radio frequency identification (RFID) tag including an on-tag fuse that is not blown. The recorded vote is not revealable while the fuse is not blown and is revealable in response to the fuse being subsequently blown. After the ballot paper is received, the ballot paper is authenticated and the fuse is blown to reveal the recorded vote, followed by counting the ballot paper and directing the ballot paper to a candidate box.

FIELD OF THE INVENTION

The present invention relates to the field of ballot paper countingmethod and more particularly to a method to strengthen an integrity of avoting process when authenticating and counting ballot papers.

BACKGROUND OF THE INVENTION

They are different methods to maximize the credibility and integrity ofthe vote counting process when initiating a voting procedure.

Some of them consist of counting ballots manually, mechanically and/orelectronically. In each case, there is a balance between-integrity,accuracy and speed. A common characteristic of these methods is tominimize opportunities for fraud and manipulation and ensuring that thepublic perception of the counting of votes is a simple, straightforwardand non-partisan process.

A manual method, like the hand counter process, attempts to do the verybest to be nonbiased and fair. Such a manual method has a degree ofsubjectivity that is an extremely important issue in a process where nosubjectivity is allowed. Moreover, a manual method is not suitable forcounting a large quantity of ballots quickly.

Today's trend of the voting process uses generally a computerized methodfor counting votes. Electronic and mechanical methods, whether mixedtogether or not, can provide an accurate and speedy vote count andannouncement of results. Whereas such methods seem to offer a robustidentification mechanism, numerous external situations can compromisethe privacy of the voter as well as the counting process accuracy.

One computerized method consists of using a PC compatible with a touchscreen especially packaged for voting, like the “Electrovote 2000”voting machine sold by Fidlar-Doubleday (formerly Fidlar and Chambers).Such a system includes a flat panel display screen on the voting machinethat has a very poor off axis viewing, so the privacy is a bit betterthan the minimal booth suggests.

A more sophisticated system, PC based, incorporates a smartcardinterface, like the “Global Election Systems Model 100 Electronic BallotStation”. In use, the machine is enabled by entering an ID code on thescreen corresponding to the polling place and each voter is given asmartcard that is available for one use. Even if using a smartcardavoids over voting in a voting machine similar to the “Electrovote2000”, the system has a very poor off axis viewing. Furthermore, thesmartcard is considered as a voter's token and does not contain anyconfidential data related to the candidate/party that minimizesconsiderably the solution interest.

Another system, based on direct recording electronic voting machines,incorporates push buttons with associated light, like the “MicrovoteElectronic Voting Computer”. The system consists of using push buttonsadjacent to each ballot item to cast votes, with a light by each buttongiving positive feedback that the vote has been registered. Such asystem contains only 64 buttons. Many voting processes, like elections,would require significantly more than this if the full ballot were to bedisplayed at once. The system can be extended for displaying morecandidates by using a complex ballot paging. A better displaying on asingle scroll, side by side is required to the voter that wants to workthrough the issues on the ballot that seems to be difficult to handle.

A standardized ballot, punched card based, was first used for vitalstatistics tabulation before adopted for voting process by using a“Votomatic” technology. The punched card contains a tabulation ofpre-printed information representing a matrix of voting positions.Generally, in many systems that use a punched card method, the ballot ispre-scored at each voting position so that punching with a stylusthrough that position into an appropriate backing will remove arectangle of chad, leaving a hole that is counted as a vote. Then, theballot card is held in proper alignment and is inserted into a votingmachine. The voting machine checks that a voted ballot paper islegitimate and deposits it in the ballot box for later countering. Thecounting machine does not recognize circling or underlining ballots andmultiple votes are ignored.

Finally, the ballots are stacked for tabulation and processed by usingeither a computer equipped with a standard punched-card reader or by anelectromechanical punched-card tabulating machine. Unfortunately, insome cases the punched card process may compromise the counting methodaccuracy.

Statistically a punched card may contain a dimple in a position insteadof a cleanly punched hole. This is due to either a voter hesitation or apre punched card failure. In addition, some punch positions on theballot can be directly over internal braces, inside the voting machinemechanism, that can develop undesirable chad jams. The development ofchad jams that are accumulated in areas where ballots are beingprocessed may represent votes added to some candidates by accident. Itis also possible to obtain a ballot that has a completely removed chadfor one candidate but also has a chad with one corner punctured foranother candidate in the same race. This ballot has to be counted as avote. The presence of dimples and undesirable chads initiates a handrecount process and it is difficult for a human by looking a dimple oran incoherent chad to determine the voter's intent.

Some electronic voting machines allow voters to show their choices andstop them if they try to over vote. These machines allow voters toreview their choices and ballots before turning them in. The name ofcandidates and the text of ballot questions are not printed on ballotsthat are based on a punch card method. This is a reason why someorganizations switch from punch cards to optical scan, in which votersfill in ovals with a pencil. In certain circumstance, it is possible totwist a ballot. Twisting a ballot can produce several “votes” on a punchcard ballot that has already been counted by machines three or moretimes that is considered as over voting. In this case, over votinginvalidates the vote.

To summarize, the aforementioned voting systems and methods presentseveral drawbacks. Some of the main drawbacks are as follows.

A manual method, like the hand counter process, has a degree ofsubjectivity that is unacceptable in such a voting process. Moreover, ahand counter process is not appropriate when counting a large quantityof ballots and is subject to mistakes, such as over voting and/or anyballot rigging, that a skilled person in the art can easily imagine.

A touch screen electronic computerized method compromises the privacy ofthe voter when using a flat panel display screen on the voting machinethat has a very poor off axis viewing.

A system based on push buttons is too difficult to be manipulated easilyby a voter.

A computerized method, punched card based, when applying in a largerange of ballots, generates undesirable chads. The difficulty torecognize a legitimate ballot when some undesirable chads appear on thecard and a necessity to hand recount ballots when a ballot fails inconformity are time consuming in a process that needs to provide resultsquickly.

As mentioned above, prior art solutions make the existing methods notfully appropriate to achieve an efficient vote counting process whileguarantying full integrity, preventing ballot rigging, and allowing fullaudit.

The present invention offers a solution to solve the aforementionedproblems.

SUMMARY OF THE INVENTION

The present invention provides a voting method, comprising:

receiving a ballot paper that includes a recorded vote comprisingcandidate/party information for an election held on a voting day in ajurisdiction, said ballot paper comprising a burnable radio frequencyidentification (RFID) tag that includes an on-tag fuse that is notblown, said recorded vote not being revealable while the fuse is notblown and being revealable in response to the fuse being subsequentlyblown;

after said receiving, authenticating said ballot paper;

after said authenticating, blowing the fuse to reveal the recorded vote;and

after said blowing the fuse, counting the ballot paper and directing theballot paper to a candidate box.

BRIEF DESCRIPTION OF THE DRAWINGS

The above and other items, features and advantages of the invention willbe better understood by reading the following more particulardescription of the invention in conjunction with the accompanyingdrawings.

FIG. 1 illustrates by schematic block diagram the relationship betweenthe elements for practicing embodiments of the present invention.

FIG. 2 sets out full details of the Ballot Paper as represented in avoting system arrangement, in accordance with embodiments of the presentinvention.

FIG. 3 sets out full details of the Ballot Box as represented in thevoting system arrangement, in accordance with embodiments of the presentinvention.

FIG. 4 shows full details of the Ballot counting and sorting machine asrepresented in the voting system arrangement, in accordance withembodiments of the present invention.

FIG. 5 is a flow chart of the Ballot Box process when a voter inserts aBallot Paper to be authenticated by the Ballot Box, in accordance withembodiments of the present invention.

FIG. 6 is a flow chart of the Ballot Sorting and Counting Machineprocess when voted ballot papers that were preliminarily checked andvalidated through the Ballot Box process are loaded into the BallotCounting and Sorting Machine, in accordance with embodiments of thepresent invention.

DETAILED DESCRIPTION OF THE INVENTION

Embodiments of the invention are described herein after by way ofexamples with reference to the accompanying figures and drawings.

The present invention to provide a system for tracking ballot papers,allowing strengthening of the audit integrity of a voting process by theuse of the radio frequency identification (RFID) technology.

The present invention integrates a wireless apparatus, RFID tag wirelesscapabilities for monitoring a voting process mechanism, ensuring thatall parts involved in the action are completely protected against ballotrigging during operation.

The present invention uses an on-tag fuse mechanism embedded in theballot paper to protect the integrity and confidentiality of the votedballot paper during operation.

The present invention uses a jurisdiction's private/public signature andits associated checksum mechanism to control dynamically the validity ofthe ongoing ballot paper.

The present invention certifies the ongoing ballot paper, in real time,by encoding an assessor's private/public signature key in a field of anRFID tag located in a Ballot Paper.

The present invention interprets the information encrypted in the ballotpaper by beaming the RFID tags located in the ballot paper.

The present invention blows the on-tag fuse of a burnable RFID tag tofree the confidential candidate information when initiating the sortingand counting process.

The present invention rejects a ballot paper non-compliant with thejurisdiction's expectations loaded in a dedicated RFID tag to anexternal compartment.

The present invention rejects a ballot paper that is not certified by anassessor's signature key loaded in a dedicated RFID tag.

The present invention rejects a ballot paper that has already beenblown, from the voting process, which indicates the non-integrity of theongoing ballot paper.

The present invention uses a wireless tracking system by mixing bothreading and writing a RFID tag in real time in concert with the statingof an on-tag fuse RFID tag, all of them implemented either on thesurface or embedded in the substrate of a Ballot Support.

A first aspect, the present invention tracks ballots and performs methodallowing strengthening of the audit integrity of a voting process byusing the RFID technology.

RFID is suitable for high technology wireless electronic systems basedon message identification. The wireless systems allow a readable machineto pick up messages stored on the tag device. The readable machine readsthe notification message, identifies the device, and then performs anaction which is indicated in the stored message.

The present invention is suitable for various countries where anelection process in a jurisdiction occurs as well as in areas where castand count is a necessity to legitimatize a vote.

Even if some solutions offer a wide variety of different RFID standards,an implemented embodiment of the present invention is motivated by theneed to provide a high-quality voting system at low cost. This isaccomplished through a voting system approach using passive RFID tags.

In an embodiment of the present invention, the disclosed RFID systemuses RFID technology that is compatible with ISO standards, includingbut not limited to ISO14443, ISO15693, ISO 18000 series.

FIG. 1 illustrates a schematic block diagram depicting the relationshipbetween the elements for practicing embodiments of the presentinvention. A voting system (100) uses the RFID technology and itsassociated facilities are methodically implemented. The voting system(100) combines a Ballot Paper (102) and a Ballot Box (104) that work inconcert with a Ballot counting and sorting Machine (106).

The Ballot Paper (102) contains confidential authentications that arestored in embedded electronic devices and interact directly with theBallot Box (104). The Ballot Box (104) receives a Ballot Paper (102)that a voter rolls into for inspection. The Ballot Box (104) controlsthe authentication of the inserted Ballot Paper (102) by screening theelectronic content previously encoded and confirms its authentication bygenerating a conformity electronic key and storing the generatedconformity electronic key in an electronic device present in the BallotPaper (102). The Ballot Box (104) rolls out the correct Ballot Papers(102). A series of Ballot Papers (102) are inserted into the Ballotcounting and sorting Machine (106) to be checked before initiating avote counting process. The Ballot counting and sorting Machine (106)verifies the authentication of the inserted Ballot Paper (102) byscreening the electronic content previously encoded and initiates a votesorting and counting process accordingly.

FIG. 2 sets out full details of the Ballot Paper as represented in avoting system arrangement, in accordance with embodiments of the presentinvention.

The design layout of the Ballot Paper (200) is similar to a classicballot paper. It provides a voter with clear printed instructions forfacilitating the choice of candidates in a valid manner as well assymbols or/and candidate pictures and essential information that printedballot papers should contain.

The difference resides in the inclusion of two electronic devicesrepresented by a basic passive RFID tag (202) and a burnable passiveRFID tag (204). The inclusion of such RFID tags (202, 204) allows theBallot Paper (200) to be safely authenticated and easily tracked allalong the voting process. The RFID tags (202, 204) can be implementedeither on the surface or embedded in the substrate of a Ballot Support(206).

The electronic personalization of the Ballot Paper (200) is defined byits instruction set, which is encoded in the basic passive RFID tag(202), at a configuration step, when emitted by the jurisdiction. Thebasic passive RFID tag (202) works differently from the burnable passiveRFID tag (204). The basic passive RFID tag (202) requires two datafields (208, 210) both working in write once and read multiple modes.

The first data field (208) contains a jurisdiction's signature (212)that identifies a genuine versus counterfeited ballot paper. Thejurisdiction's signature (212) is encrypted with a private key belongingto an emitting authority to be disclosed on the voting day. The emittingauthority is associated with the jurisdiction.

The jurisdiction's signature (212) is generated and stored during theconfiguration of the Ballot Paper (200) and cannot be modified. Thejurisdiction's signature (212) allows keeping track of theauthentication integrity of the Ballot Paper (200) and thereby warrantsthat the voting processing operates in a secure protocol.

The second data field (210) stores an assessor's signature key that iscomposed of a hashing of the assessors individual secret keys (214). Theassessor's signature key (214) is generated during the vote processingof the Ballot Paper (200). Like the first data field (208), the seconddata field (210) is unchangeable.

The assessor's signature key (214) is put on the second data field (210)after authenticating the Ballot Paper (200), once inserted in the BallotBox. It is noted that the assessor's signature key (214) can concatenatedifferent information that form a secure encrypted message, like anassessor identification, via a personal key, when validating the voter'sact and/or a ballot number. Depending on the voting strategy, theassessor's signature key (214) can also contain a voter's voting choice,like the name of the candidate if the Ballot Paper has not beenpersonalized yet.

In contrast with the basic passive RFID tag (202), the burnable passiveRFID tag (204) includes an on-tag fusing facility and its associatedelectronic circuitry (216).

Such technique includes developing, implementing and manufacturingon-tag extra circuitry which is capable of handling a predefined action,if needed. An external fuse blowing system is required to set the on-tagfuse in any manner known in the art, (i.e. laser fuse blow, electricalfuse blow and so on). In one embodiment of the present invention, theburnable passive RFID tag is a chipless tag.

Once the on-tag fuse is blown, the internal circuitry of the burnablepassive RFID tag (204) works differently than before and is capable topresent other data to the RFID reader.

When initiating an election process, it is very important to protect theintegrity of a Ballot Paper (200) and track any potential violationoccurring during the voting cycle. To meet these requirements, theburnable passive RFID tag (204) has a hard-coded ballot paperidentification (218) embedded in its data field (220).

The burnable passive RFID tag (204) operates in twofold.

Firstly, the non-blowing of the on-tag fuse (216) warrants the BallotPaper (200) integrity including the confidentiality of the name of thecandidate/party during the voting process until the final counting andsorting are initiated. The embedded hard-coded ballot paperidentification (218) cannot be accessible by a RFID reader, a RFID tagcleaner/eraser, or an eavesdropping mechanism allowing undesirablerigging. The hard-coded ballot paper identification (218) hostsunchangeable data related to information on candidate/party, at leastthe party or candidate name or any other information that a skilledperson in the art can easily imagine. Non-blowing on-tag fuse (216)preserves Ballot Paper (200) authenticity. A masking code (222) hidesthe content of the embedded hard-coded ballot paper identification (218)until the on-tag fuse (216) is intact.

Secondly, the blowing of the on-tag fuse (216) frees the hard-codedballot paper identification (218) hosted in the RFID tag data field(220) that reveals the candidate/party information to be identified bythe Ballot counting and sorting Machine (106). Blowing on-tag fuse (216)is irreversible and makes the Ballot Paper (200) unique and notreusable. An adequate mechanism (not shown here) reads, controls, andvalidates the hard-coded identification at the counting and sortingstep.

FIG. 3 describes details of the Ballot Box, in accordance withembodiments of the present invention. The Ballot Box (300) comprises aRFID Reader Module (302), an Authentication and Validation Checker(304), an Assessor Key Matrix (306), a Signature Key Generator (308), aFuse Blowing Checker (310), a Decision Handler (312) and a Ballot PaperRFID tag Writer (314).

The process starts when a voter inserts a Ballot Paper (102) in theBallot Box (300). It is to be noted that, alternatively, the BallotPaper may be inserted first in an envelope to make the voter's act moreconfidential.

The RFID Reader Module (302) beams the inserted ballot paper, reads datafrom RFID tag registers, and transmits the inserted ballot paper beamingdata to the Authentication and Validation Checker (304).

The Authentication and Validation Checker (304) receives the insertedballot paper beaming data from the RFID Reader Module (302) andinitiates an authentication procedure. Typically, the authenticationprocedure decrypts the jurisdiction's signature with a jurisdictionpublic key and compares the jurisdiction's decrypted signature to thejurisdiction's specific fixed number which is a jurisdiction codeconstant. The emitting authority discloses the jurisdiction's specificfixed number on the voting day. Both the jurisdiction's specific fixednumber and the jurisdiction's public key are stored during theconfiguration of the Ballot Box.

The Authentication and Validation Checker (304) is coupled to theAssessor Key Matrix (306) and interfaces with the Decision Handler(312). The Decision Handler (312) receives data from the Signature KeyGenerator (308) and the Ballot Paper RFID tag Writer (314) and interactswith the Fuse Blowing Checker (310).

The Assessor Key Matrix (306) allows an assessor to enter theconfidential jurisdiction code constant (i.e., the jurisdiction'sspecific fixed number) before starting the voting process. Thejurisdiction delivers the confidential jurisdiction code constant. It isjust valid for a day, like the current voting day, and cannot bemodifiable by a third party.

The Authentication and Validation Checker (304) runs the jurisdiction'ssignature (212) located in the first data field (208) of the basic RFIDtag (202) through its checker. Then, it compares the jurisdiction'ssignature with the confidential jurisdiction code constant previouslyentered by the assessor, starts authentication of a valid ballot paper,and sends the authentication result to the Decision Handler (312).

The Decision Handler (312) identifies the ballot paper that correspondsto a valid result and rejects the other ones to a bin (Bin) outside theballot box.

To authenticate a voted ballot paper in regards to the jurisdiction, theidentified ballot paper receives an assessor's signature key (214) froman assessor, via the Signature Key Generator (308).

The Signature Key Generator (308) inputs the assessor data entered bythe use of the Assessor Key Matrix (306) and generates the assessor'ssignature key (214), authenticating the voted ballot paper, accordingly.Then, Ballot Paper RFID tag Writer (314) writes the signature key intothe second data field (210) of the basic RFID tag (202).

There exist different possibilities for creating such signature key(214), including: either a removable keyboard for keying the encryptedkey; a memory plug interface, like USB or memory or smartcard, forconnecting a personal encrypted key module holding an individual code;or by using other electronic apparatus that a person who is skilled inthe art can easily imagine.

Then the Decision Handler (312) transmits the voted ballot paper to theFuse Blowing Checker (310). The Fuse Blowing Checker (310) checks that avoted ballot paper is still blank, meaning that the fuse is not blown.The Fuse Blowing Checker (310) operates by stating the non-blowing ofthe on-tag fuse of the burnable passive RFID tag (204) and by readingthe information hosted in the RFID tag data field. The Fuse BlowingChecker (310) communicates results to the Decision Handler (312).

The Decision Handler (312) identifies the ballot paper that correspondsto a legitimate voted ballot paper and rejects the other ones to a bin(Bin) outside the ballot box. The legitimate voted ballot is output fromthe Ballot Box (300) to be counted and sorted by using the Ballotcounting and sorting Machine (106). As mentioned above, the legitimatevoted ballot paper is generally inserted in an envelope to make thevoter's act confidential.

Referring now to FIG. 4, details of the “Ballot Counting and SortingMachine” is described, in accordance with embodiments of the presentinvention. The “Ballot Counting and Sorting Machine” (400) comprises aRFID Reader Module (402), an Authentication and Validation Checker(404), an Assessor Key Matrix (406), a Fuse Blowing Checker (408), aFuse Blowing Engine (410), a Decision Handler (412), and acounting-sorting mechanism (414).

The process starts when ballots to be counted, that were preliminarilychecked and validated through the Ballot Box (104), are loaded into theBallot Counting and Sorting Machine (400).

The RFID Reader Module (402) beams the loaded ballot paper(voted-ballot), reads data from RFID tag registers in the ballot paper,and transmits the loaded ballot paper beaming data to the Authenticationand Validation Checker (404).

The Authentication and Validation Checker (404) receives the loadedballot paper beaming data from the RFID Reader Module (402) andinitiates an authentication procedure.

The authentication procedure decrypts the jurisdiction's signature witha jurisdiction public key and compares the jurisdiction's signature to ajurisdiction's specific fixed number (i.e., confidential jurisdictioncode constant). The emitting authority discloses the jurisdiction'sspecific fixed number on the voting day.

The Authentication and Validation Checker (404) is coupled to theAssessor Key Matrix (406) and interfaces with the Decision Handler(412), the Fuse Blowing Checker (408) and the Fuse Blowing Engine (410).

The Decision Handler (412) interacts with the Fuse Blowing Checker(408), receives data from the Fuse Blowing Engine (410), and initiatesthe Counting-Sorting Mechanism (414).

An assessor enters both a confidential jurisdiction code constant and aconfidential assessor code constant by the use of the Assessor KeyMatrix (406). Both code constants allow the Ballot Counting and SortingMachine (400) to be initialized, protected and locked during the currentvoting process.

The jurisdiction delivers the confidential code constants. They are justvalid for a day, like the current voting day, and cannot be modified bya third party.

The Authentication and Validation Checker (404) works in twofold.

Firstly, it runs the jurisdiction's signature (212) located in the firstdata field (208) of the basic RFID tag (202) through its checker. Then,it compares the jurisdiction's signature with the confidentialjurisdiction code constant, starts authentication of voted ballot paperand sends the authentication result to the Decision Handler (412).

Secondly, it runs the assessor's signature key (214) located in thesecond data field (210) of the basic RFID tag (202) through its checker.Then, it compares the assessor's signature key with the confidentialassessor code constant, which starts authentication of voted ballotpaper and sends result to the Decision Handler (412).

It is aforementioned here, that both the confidential jurisdiction codeconstant and the confidential assessor code constant are inputs that theassessor pre-sets before the process starts.

The Decision Handler (412) authenticates the voted ballot papers thatcorrespond to a valid result, transmits the valid ballots to the FuseBlowing Checker (408) and rejects the other ballots to a bin (Bin)outside the Ballot Counting and Sorting Machine (400).

The Fuse Blowing Checker (408) checks that a voted ballot paper is stillblank. The Fuse Blowing Checker (408) operates by stating thenon-blowing of the on-tag fuse of the burnable passive RFID tag (204)and by reading the information hosted in the RFID tag data field. TheFuse Blowing Checker (408) communicates results to the Decision Handler(412).

The Decision Handler (412) authenticates the voted ballot papers thatare still blank, transmits the blank ballots to the Fuse Blowing Engine(410) and rejects the other ballots to a bin outside the Ballot Countingand Sorting Machine (400).

The Fuse Blowing Engine (410) receives the authenticated voted ballotpaper and starts an on-tag fuse blowing operation of the burnablepassive RFID tag (204).

The on-tag fuse blowing operation is irreversible and frees thehard-coded identification hosted in the RFID tag field that reveals thecandidate/party information. Thus the on-tag fuse blowing operationenables the voted ballot paper to be read by the Ballot counting andsorting Machine (400). Methods and systems to blow such on-tag fuses arewell known in the art and will not be further described.

The authentication of the voted ballot papers is complete and theDecision Handler (412) enables the Counting-Sorting Mechanism (414) toinitiate the counting and sorting process. The Counting-SortingMechanism (414) reads the voted ballot papers, counts the voted ballotpapers, and directs the envelopes containing a voted ballot paper to thepertinent candidate box.

FIG. 5 is a flow chart of the Ballot Box process when a voter inserts aBallot Paper to be authenticated by the Ballot Box, in accordance withembodiments of the present invention.

Before the Ballot Box process starts (500) a ballot paper configurationis required in which an acquisition of the jurisdiction's parametersbelonging to the election are to be entered in step 502.

After completion of the Ballot Box process in step 520, the processenters the Ballot Sorting and Counting Machine process described infrawith reference to FIG. 6.

Step 502 (Ballot Paper Configuration): Jurisdiction configures a blankballot paper. Design layout and RFID tag electronic personalization ofthe ballot paper is defined. Jurisdiction's signature is hard-coded inthe dedicated field of the basic RFID tag. On-tag fuse of the burnableRFID tag is intact. Then, the process goes to step 504.

Step 504 (Ballot Box initialization): Assessor enters the Jurisdiction'sspecific fixed number, as well as the jurisdiction's public key by theuse of the Assessor Key Matrix (306). Then, the process goes to step506.

Step 506 (Ballot Paper Screening): Voter inserts a ballot paper in theballot box. The RFID Reader Module (302) beams the inserted ballot paper(ballot-Paper), reads the ballot paper beaming data from RFID tagregisters and transmits the ballot paper beaming data to theAuthentication and Validation Checker (304). Then, the process goes tostep 508.

Step 508 (Ballot Paper authentication): The Authentication andValidation Checker (304) runs the jurisdiction's public/privatesignature (212) located in the first data field (208) of the basic RFIDtag (202) through its checker. Then, it compares the jurisdiction'ssignature with the confidential jurisdiction code constant previouslyentered by the assessor at step 504, starts authentication of a validballot paper and sends result to the Decision Handler (312). Then theprocess goes to step 510.

In step 510, a status is made to check the integrity of the voted ballotpaper. The Decision Handler (312) checks the result delivered by thechecker computation at step 508. If the result is valid then thecorresponding ballot paper is valid and the process goes to step 514;otherwise the ballot paper is not valid and the process goes to step512.

Step 512 (Ballot paper rejection): Ballot paper is not valid and isrejected by the Decision Handler (312). The rejected ballot paper rollsout to a bin outside the ballot box. Then the process loops back to step506.

Step 514 (Assessor voted ballot authentication): Assessor enters theAssessor's signature key by the use of the Assessor Key Matrix (306)that initiates the Signature Key Generator (308). A signature key isgenerated accordingly. Then, the process goes to step 516.

Step 516 (Writing assessor key to RFID tag): Assessor validates thevoted ballot paper that enables the Ballot Paper RFID tag Writer (314)for writing the computed signature key into the second data field (210)of the basic RFID tag (202). Then the process goes to step 518.

In step 518, a status is made to check that the voted ballot paper isblank. The Fuse Blowing Checker (310) receives the voted ballot paperand states the on-tag fuse of the burnable passive RFID tag (204). Ifthe Fuse Blowing Checker (310) detects a non-blowing of the on-tag fusethen the voted ballot paper is valid and the process goes to step 520;otherwise the voted ballot paper is not blank and the process goes tostep 512.

Step 520 (Ballot Box process completion): The success of thejurisdiction's private/public key identification, the non-blowing of theon-tag fuse, and the insertion of the assessor's private/public keycertification into the RFID tag authenticate the integrity of theinserted ballot paper. The voted ballot paper is output from the BallotBox (300) to be counted and sorted by using the Ballot Counting andSorting Machine (106). The Ballot Box process is complete then theprocess loops back to step 506 for authenticating the next ballot paperthat a voter inserts in the Ballot Box (300).

FIG. 6 is a flow chart of the Ballot Sorting and Counting Machineprocess (600) when voted ballot papers that were preliminarily checkedand validated through the Ballot Box process are loaded into the BallotCounting and Sorting Machine, in accordance with embodiments of thepresent invention.

Step 602 (Voted ballot counting-sorting machine initialization):Assessor enters the Jurisdiction's specific fixed number, as well as thejurisdiction's public key by the use of the Assessor Key Matrix (406).Then, the process goes to step 604.

Step 604 (Voted Ballot Paper Screening): Ballots to be counted, thatwere preliminarily checked and validated through the Ballot Box (104)are loaded into the Ballot Counting and Sorting Machine (400). The RFIDReader Module (402) beams the loaded ballot paper, reads ballot paperbeaming data from all RFID tag registers and transmits the ballot paperbeaming data to the Authentication and Validation Checker (404). Then,the process goes to step 606.

Step 606 (Voted Ballot Paper authentication): The Authentication andValidation Checker (404) runs the jurisdiction's public/privatesignature (212) located in the first data field (208) of the basic RFIDtag (202) through its checker. In addition, it runs the assessor'ssignature key (214) located in the second data field (210) of the basicRFID tag (202) through its checker. Then, it compares the jurisdiction'ssignature and the assessor's signature key with the confidentialjurisdiction code constant and the confidential assessor code constant,respectively, which starts authentication of voted ballot paper andsends result to the Decision Handler (412). Then the process goes tostep 608.

In step 608, a status is made to check the integrity of the voted ballotpaper. The Decision Handler (412) checks the result delivered by thechecker computation at step 606. If the check results are valid then thecorresponding ballot paper is valid and the process goes to step 612;otherwise the ballot paper is not valid and the process goes to step610.

Step 610 (Voted Ballot paper rejection): Voted ballot paper is not validand is rejected by the Decision Handler (412). The rejected voted ballotpaper rolls out to a bin outside the Ballot Counting and Sorting Machine(400). Then the process loops back to step 604.

In step 612, a status is made to check that the voted ballot paper isblank. The Fuse Blowing Checker (408) receives the voted ballot paperand states the on-tag fuse of the burnable passive RFID tag (204). Ifthe Fuse Blowing Checker (408) detects a non-blowing of the on-tag fusethen the voted ballot paper is valid and the process goes to step 614;otherwise the voted ballot paper is not blank and the process goes tostep 610.

Step 614 (Unlocking Voted ballot paper): The Fuse Blowing Engine (410)initiates the on-tag fuse blowing operation of the burnable passive RFIDtag (204). This operation frees the hard-coded identification hosted inthe RFID tag field that reveals the candidate/party

1. A voting method, comprising: receiving a ballot paper that includes a recorded vote comprising candidate/party information for an election held on a voting day in a jurisdiction, said ballot paper comprising a burnable radio frequency identification (RFID) tag that includes an on-tag fuse that is not blown, said recorded vote not being revealable while the fuse is not blown and being revealable in response to the fuse being subsequently blown; after said receiving, authenticating said ballot paper; after said authenticating, blowing the fuse to reveal the recorded vote; and after said blowing the fuse, counting the ballot paper and directing the ballot paper to a candidate box.
 2. The method of claim 1, wherein the paper ballot further comprises a basic RFID tag that differs from the burnable RFID tag, and wherein the method further comprises: storing a signature of the jurisdiction in a first data field of the basic RFID tag; and receiving from an assessor on the voting day a confidential jurisdiction code constant, wherein said authenticating comprises determining a first match between the received confidential jurisdiction code constant and the signature of the jurisdiction stored in the first data field of the basic RFID tag.
 3. The method of claim 2, wherein the signature of the jurisdiction stored in the first data field of the basic RFID tag is encrypted with a private key belonging to an emitting authority associated with the jurisdiction, and wherein said determining the first match comprises: decrypting the private key with a public key of a public/private key pair that includes the private key, said decrypting the private key generating an unencrypted signature of the jurisdiction; and determining that the received confidential jurisdiction code constant and the unencrypted signature of the jurisdiction match each other.
 4. The method of claim 2, wherein said determining the first match warrants that the voting method is operating in a secure protocol.
 5. The method of claim 2, wherein the received confidential jurisdiction code constant is valid only on the voting day.
 6. The method of claim 2, wherein the received confidential jurisdiction code constant cannot be modified.
 7. The method of claim 2, wherein the method further comprises personalizing the ballot paper by encoding an instruction set into the basic RFID tag
 8. The method of claim 2, wherein the method further comprises: receiving from the assessor on the voting day a confidential assessor code constant; information, which enables the voted ballot paper to be read by the Ballot Counting and Sorting Machine (400). Then the process goes to step
 616. Step 616 (Counting-sorting Enabling): The success of both the jurisdiction's private/public key and the assessor's private/public key certification identification associated with the non-blowing of the on-tag fuse authenticate the integrity of the loaded voted ballot paper. The voted ballot paper meets the jurisdiction requirements in terms of integrity and accuracy that enables the Counting-Sorting Mechanism (414). Then the process goes to step
 618. Step 618 (Counting-Sorting running): The Counting-Sorting Mechanism (414) reads the voted ballot paper that comprises the revealed candidate/party information, counts the voted ballot paper, and directs the envelope containing the voted ballot paper to the adequate candidate box. In one embodiment, the candidate box is associated with the revealed candidate/party information. Then the process goes to step
 620. In step 620, a status is made to detect the last voted ballot paper that was loaded in the machine. If the last voted ballot paper occurs then the running sorting-counting process is complete and the process goes to step 622; otherwise the process loops back to step 604 until the last loading of a voted ballot paper occurs. Step 622 (Counting-Sorting completion): Occurrence of the last voted ballot paper indicates that the sorting-counting process is complete. It has to be appreciated that while the invention has been particularly shown and described with reference to embodiments of the present invention, various changes in form and detail may be made therein without departing from the spirit, and scope of the invention. after determining the first match, generating a signature key of the assessor; storing the generated signature key in a second data field of the basic RFID tag, wherein said authenticating comprises determining a second match between the received confidential assessor code constant and the signature key stored in the second data field of the basic RFID tag.
 9. The method of claim 8, wherein the received confidential assessor code constant is valid only on the voting day.
 10. The method of claim 8, wherein the received confidential assessor code constant cannot be modified.
 11. The method of claim 8, wherein the generated signature key comprises a hashing of individual secret keys of the assessor.
 12. The method of claim 8, wherein the generated signature key comprises the recorded vote.
 13. The method of claim 8, wherein said authenticating comprises: after said storing the generated signature key and before said determining the second match, determining that the fuse is not blown.
 14. The method of claim 13, wherein said authenticating comprises after determining that the fuse is not blown: obtaining from the assessor on the voting day the confidential jurisdiction code constant and the confidential assessor code constant; determining a third match between the obtained confidential jurisdiction code constant and the signature of the jurisdiction stored in the first data field of the basic RFID tag; determining a fourth match between the obtained confidential assessor code constant and the signature key stored in the second data field of the basic RFID tag after said determining the third match and said determining the fourth match, determining that the fuse is not blown.
 15. The method of claim 2, wherein the basic RFID tag is a passive RFID tag.
 16. The method of claim 1, wherein the burnable RFID tag is a passive RFID tag.
 17. The method of claim 1, wherein the burnable RFID tag is a chipless RFID tag.
 18. The method of claim 1, wherein the burnable RFID tag comprises a hard-coded identification of the ballot paper, and wherein the hard-coded identification hosts unchangeable data related to the candidate/party information.
 19. The method of claim 18, wherein the ballot paper comprises a masking code that hides content of the hard-coded ballot identification.
 20. The method of claim 1, wherein said blowing the fuse results in the ballot paper being unique and not reusable. 